1. Field of the Invention
This invention relates generally to techniques for authorizing the use of protected information and, in particular, to a portable authorization device (commonly known as a “dongle”) for authorizing a host system to use protected information.
2. Description of the Related Art
A software “wrapper” is a commonly used technique for selectively authorizing the use of protected information associated with a host system such as a personal computer or a server. The protected information, for example, may comprise a software program to be executed, or data to be processed, by the host system. The software wrapper permits an end-user to access or execute the protected program or data only if a predetermined condition is met. The predetermined condition can be, for example, the running of a trial period that allows the end-user to evaluate the protected program or data or the presentation of the proper authorization information by the end-user. The authorization information, for example, may be a password manually entered by the end-user or digitally encoded data. A discussion of software wrappers can be found, for example, in The Seybold Report on Internet Publishing, December 1997, no. 4, vol. 2, p. 3.
There are several techniques known in the art for delivering authorization information to authorize a host system to use protected information. In one technique, the authorization information is stored on a portable authorization device that is commonly known as a “dongle.” Dongles are small, readily transportable electronic devices as described, for example, in U.S. Pat. No. 4,562,306. Dongles are typically provided by the software vendor together with the wrapped software program they are intended to authorize.
To enable the software program to run on a particular computer, the end-user simply connects the dongle to a communications port of the computer, such as a parallel port or Universal Serial Bus (USB) port. Therefore, the end-user can authorize a number of different computers to run the program simply by connecting the dongle to whichever computer that he or she desires to run the program on at any given time.
However, a disadvantage presented by dongles is that they typically store authorization information for only one software program or perhaps for a group of software programs from a single vendor. Consequently, because an end-user typically might use several software programs from multiple vendors at any given time, he or she might have to carry around multiple dongles, which could be cumbersome and inconvenient.
Another disadvantage is that the authorization information stored in the dongle is typically set by the software vendor during manufacture and generally cannot be subsequently updated. As a result, when a software vendor provides an end-user with a software upgrade, add-on or plug-in, etc. for a protected software program, the vendor often also delivers a new dongle to authorize the associated software. This is not very cost-effective for software vendors because the cost of the dongle itself can be significant in relation to the value of the associated software.
In a second technique known in the art, the authorization information is stored on a magnetic floppy disk known as a “key diskette.” The key diskette may be considered a type of information authority, which is a secure and trusted device for transmitting and receiving information. The key diskette is typically provided by the software vendor with the wrapped software program. To authorize the software program to run on a particular computer, the end-user inserts the key diskette in the computer to transfer the authorization information, typically a secret key, from the key diskette to the hard disk drive of the computer. Before the computer begins execution of the program, the software wrapper verifies that the correct key is present on the hard disk drive, and if so, allows the computer to execute the program. This technique is used in the Pace Anti-Piracy InterLok product, which was developed by the applicant of the present invention.
An advantage of this technique over dongles is that authorization information for many different software programs from multiple vendors can be stored on the hard disk drive of the computer. Consequently, an end-user who runs multiple programs on a computer does not need to keep multiple key diskettes on hand to authorize each of the programs.
This technique suffers from several shortcomings, however. First, the authorization information is not readily transferable between computers. Typically, the key diskette is permitted to transfer the authorization information to only a limited number of computers at any given time. Once the authorization information is transferred to a particular computer, the authorization cannot be readily transferred from that computer to another computer because it is stored on that computer's internal hard disk drive. Consequently, if the end-user wants to authorize a new computer to run a software program but the key diskette has run out of authorizations, the authorization information must be removed from one of the computers containing the authorization information and transferred to the new computer—a rather cumbersome operation. Therefore, unlike dongles, this technique does not allow authorization information to be readily transferred between computers. Another disadvantage of this technique is that floppy disks are gradually being phased out of use as data input devices for computers so that in the near future computers may not be able to read the key diskettes.
A third technique described in U.S. Pat. No. 5,854,891, issued to Postlewaite (“the '891 patent”) describes a security device for enabling selected functions to be performed by or within a computer connected to the security device. The security device includes a smart card reader for reading data from smart cards, which may be considered to be a type of information authority. The security device also includes a control module having a segmented non-volatile memory composed of a plurality of segments. Enabling data from a plurality of smart cards is read by the smart card reader and entered into the segmented non-volatile memory. Each segment of the segmented non-volatile memory creates a virtual token essentially duplicating the enabling ability of the corresponding smart card. The security device is detachable from the computer and thus can be used to enable functions on multiple computers.
An advantage of the security device described in the '891 patent is that it is relatively inexpensive for a software vendor to provide authorization information for software updates, add-ons, plug-ins, etc. because the authorization information is delivered using smart cards rather than dongles. Smart cards are significantly less expensive than conventional dongles because they are typically implemented with simpler hardware.
However, the security device of the '891 patent suffers from several disadvantages. First, the security device requires a “segmented” memory to prevent the smart cards stored in the memory from interfering with each other and possibly corrupting one another's data. This increases the complexity and cost of the security device because it necessitates that the device implement memory management or protection mechanisms in hardware and/or software. Second, the security device apparently is not capable of receiving authorization information from multiple types of information authorities. The '891 patent mentions that the security device can receive enabling data or authorization information from smart cards. However, the patent does not disclose or suggest that the device can receive authorization information from other types of information authorities, such as floppy disks or computer servers. Consequently, it appears that the use of the security device as an authorization device is limited to those software vendors that support smart cards as a data delivery mechanism.
In view of the shortcomings of the above-described techniques, it is an object of the invention to provide an authorization device for authorizing the use of protected information that can be updated with new authorization information and yet is removably couplable to host devices, readily portable and relatively inexpensive.
A second object of the invention is to provide a portable authorization device that can receive and store authorization information from multiple types of information authorities.
A third object of the invention is to provide a portable authorization device that offers a high level of security to prevent unauthorized access to the authorization information when stored or being transmitted.